﻿using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Diagnostics;
using System.Linq;
using System.Runtime.InteropServices;
using System.Text;
using JasLib.Extensions;

namespace JasLib.Interop.Win32
{
    public static class ADVAPI32
    {
        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "AbortSystemShutdown", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
        [return: MarshalAs(UnmanagedType.Bool)]
        public static extern bool AbortSystemShutdown([In] string lpMachineName);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "ChangeServiceConfig2", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
        [return: MarshalAs(UnmanagedType.Bool)]
        public static extern bool ChangeServiceConfig2(
            [In] SC_HANDLE hService,
            [In] ServiceConfigInfoLevel dwInfoLevel,
            [In] UINT_PTR lpInfo);

        /// <summary>
        /// For use with SERVICE_CONFIG_DESCRIPTION.
        /// </summary>
        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "ChangeServiceConfig2", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
        [return: MarshalAs(UnmanagedType.Bool)]
        public static extern bool ChangeServiceConfig2(
            [In] SC_HANDLE hService,
            [In] ServiceConfigInfoLevel dwInfoLevel,
            [In] ref SERVICE_DESCRIPTION lpInfo);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "CloseServiceHandle", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
        [return: MarshalAs(UnmanagedType.Bool)]
        public static extern bool CloseServiceHandle([In] UINT_PTR hSCObject);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "CloseTrace", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
        public static extern Win32ErrorCode CloseTrace([In] TRACEHANDLE TraceHandle);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "ControlService", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
        [return: MarshalAs(UnmanagedType.Bool)]
        public static extern bool ControlService(
            [In] SC_HANDLE hService,
            [In] ServiceControlCode dwControl,
            [Out] out SERVICE_STATUS lpServiceStatus);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "ControlTraceW", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
        public static extern Win32ErrorCode ControlTrace(
            [In] TRACEHANDLE SessionHandle,
            [In, MarshalAs(UnmanagedType.LPWStr)] string SessionName,
            [In, Out] ref EVENT_TRACE_PROPERTIES Properties,
            [In] TraceControlCode ControlCode);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "CreateServiceW", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
        public static extern SC_HANDLE CreateService(
            [In] SC_HANDLE hSCManager,
            [In, MarshalAs(UnmanagedType.LPWStr)] string lpSvcName,
            [In, MarshalAs(UnmanagedType.LPWStr)] string lpDisplayName,
            [In] ServiceAccessRights dwDesiredAccess,
            [In] ServiceType dwServiceType,
            [In] ServiceStartType dwStartType,
            [In] ServiceErrorControl dwErrorControl,
            [In, MarshalAs(UnmanagedType.LPWStr)] string lpPathName,
            [In, MarshalAs(UnmanagedType.LPWStr)] string lpLoadOrderGroup,
            [Out] out uint lpdwTagId,
            [In, MarshalAs(UnmanagedType.LPWStr)] string lpDependencies,
            [In, MarshalAs(UnmanagedType.LPWStr)] string lpServiceStartName,
            [In, MarshalAs(UnmanagedType.LPWStr)] string lpPassword);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "CreateServiceW", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
        public static extern SC_HANDLE CreateService(
            [In] SC_HANDLE hSCManager,
            [In, MarshalAs(UnmanagedType.LPWStr)] string lpSvcName,
            [In, MarshalAs(UnmanagedType.LPWStr)] string lpDisplayName,
            [In] ServiceAccessRights dwDesiredAccess,
            [In] ServiceType dwServiceType,
            [In] ServiceStartType dwStartType,
            [In] ServiceErrorControl dwErrorControl,
            [In, MarshalAs(UnmanagedType.LPWStr)] string lpPathName,
            [In, MarshalAs(UnmanagedType.LPWStr)] string lpLoadOrderGroup,
            [In] UINT_PTR lpdwTagId,
            [In, MarshalAs(UnmanagedType.LPWStr)] string lpDependencies,
            [In, MarshalAs(UnmanagedType.LPWStr)] string lpServiceStartName,
            [In, MarshalAs(UnmanagedType.LPWStr)] string lpPassword);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "CreateTraceInstanceId", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
        public static extern Win32ErrorCode CreateTraceInstanceId(
            [In] HANDLE RegHandle,
            [Out] out EVENT_INSTANCE_INFO pInstInfo);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "DeleteService", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
        [return: MarshalAs(UnmanagedType.Bool)]
        public static extern bool DeleteService([In] SC_HANDLE hService);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "EnableTrace", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
        public static extern Win32ErrorCode EnableTrace(
            [In] uint Enable,
            [In] uint EnableFlag,
            [In] uint EnableLevel,
            [In, MarshalAs(UnmanagedType.LPStruct)] Guid ControlGuid,
            [In] TRACEHANDLE SessionHandle);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "EnableTraceEx", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
        public static extern Win32ErrorCode EnableTraceEx(
            [In, MarshalAs(UnmanagedType.LPStruct)] Guid ProviderId,
            [In, MarshalAs(UnmanagedType.LPStruct)] Guid SourceId,
            [In] TRACEHANDLE TraceHandle,
            [In] uint IsEnabled,
            [In] TraceLevel Level,
            [In] ulong MatchAnyKeyword,
            [In] ulong MatchAllKeyword,
            [In] ref EVENT_FILTER_DESCRIPTOR EnableFilterDesc);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "EnableTraceEx2", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
        public static extern Win32ErrorCode EnableTraceEx2(
            [In] TRACEHANDLE TraceHandle,
            [In, MarshalAs(UnmanagedType.LPStruct)] Guid ProviderId,
            [In] EventControlCode ControlCode,
            [In] TraceLevel Level,
            [In] ulong MatchAnyKeyword,
            [In] ulong MatchAllKeyword,
            [In] ref ENABLE_TRACE_PARAMETERS EnableParameters);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "EnumerateTraceGuids", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
        public static extern Win32ErrorCode EnumerateTraceGuids(
            [In, Out, MarshalAs(UnmanagedType.LPArray, SizeParamIndex = 1)] TRACE_GUID_PROPERTIES[] GuidPropertiesArray,
            [In] uint PropertyArrayCount,
            [Out] out uint GuidCount);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "EnumerateTraceGuidsEx", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi)]
        public static extern Win32ErrorCode EnumerateTraceGuidsEx(
            [In] TRACE_QUERY_INFO_CLASS TraceQueryInfoClass,
            [In, MarshalAs(UnmanagedType.LPArray, SizeParamIndex = 2)] byte[] InBuffer,
            [In] uint InBufferSize,
            [Out, MarshalAs(UnmanagedType.LPArray, SizeParamIndex = 4)] byte[] OutBuffer,
            [In] uint OutBufferSize,
            [Out] out uint ReturnLength);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "EventAccessControl", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi)]
        public static extern Win32ErrorCode EventAccessControl(
            [In, MarshalAs(UnmanagedType.LPStruct)] Guid Guid,
            [In] EVENTSECURITYOPERATION Operation,
            [In, MarshalAs(UnmanagedType.LPArray)] byte[] Sid,
            [In] WmiGuidAccessRights Rights,
            [In] BOOLEAN AllowOrDeny);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "EventAccessQuery", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
        public static extern Win32ErrorCode EventAccessQuery(
            [In, MarshalAs(UnmanagedType.LPStruct)] Guid Guid,
            [In, MarshalAs(UnmanagedType.LPArray, SizeParamIndex = 2)] byte[] Buffer,
            [In, Out] ref uint BufferSize);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "EventAccessRemove", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
        public static extern Win32ErrorCode EventAccessRemove(
            [In, MarshalAs(UnmanagedType.LPStruct)] Guid Guid);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "EventActivityIdControl", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
        public static extern Win32ErrorCode EventActivityIdControl(
            [In] EventActivityControlCode ControlCode,
            [In, Out] ref Guid ActivityId);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "EventEnabled", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
        public static extern BOOLEAN EventEnabled(
            [In] REGHANDLE RegHandle,
            [In] ref EVENT_DESCRIPTOR EventDescriptor);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "EventProviderEnabled", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
        public static extern BOOLEAN EventProviderEnabled(
            [In] REGHANDLE RegHandle,
            [In] TraceLevel Level,
            [In] ulong Keyword);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "EventRegister", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
        public static extern Win32ErrorCode EventRegister(
            [In, MarshalAs(UnmanagedType.LPStruct)] Guid ProviderId,
            [In] ENABLECALLBACK EnableCallback,
            [In] UINT_PTR CallbackContext,
            [Out] out REGHANDLE RegHandle);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "EventUnregister", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
        public static extern Win32ErrorCode EventUnregister([In] REGHANDLE RegHandle);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "EventWrite", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
        public static extern Win32ErrorCode EventWrite(
            [In] REGHANDLE RegHandle,
            [In] ref EVENT_DESCRIPTOR EventDescriptor,
            [In] uint UserDataCount,
            [In, MarshalAs(UnmanagedType.LPArray, SizeParamIndex = 3)] EVENT_DATA_DESCRIPTOR[] UserData);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "EventWriteEx", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
        public static extern Win32ErrorCode EventWriteEx(
            [In] REGHANDLE RegHandle,
            [In] ref EVENT_DESCRIPTOR EventDescriptor,
            [In] ulong Filter,
            [In] uint Flags,
            [In, MarshalAs(UnmanagedType.LPStruct)] Guid ActivityId,
            [In, MarshalAs(UnmanagedType.LPStruct)] Guid RelatedActivityId,
            [In] uint UserDataCount,
            [In, MarshalAs(UnmanagedType.LPArray, SizeParamIndex = 6)] EVENT_DATA_DESCRIPTOR[] UserData);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "EventWriteString", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
        public static extern Win32ErrorCode EventWriteString(
            [In] REGHANDLE RegHandle,
            [In] TraceLevel Level,
            [In] ulong Keyword,
            [In, MarshalAs(UnmanagedType.LPWStr)] string String);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "EventWriteTransfer", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi)]
        public static extern Win32ErrorCode EventWriteTransfer(
            [In] REGHANDLE RegHandle,
            [In] ref EVENT_DESCRIPTOR EventDescriptor,
            [In, MarshalAs(UnmanagedType.LPStruct)] Guid ActivityId,
            [In, MarshalAs(UnmanagedType.LPStruct)] Guid RelatedActivityId,
            [In] uint UserDataCount,
            [In, MarshalAs(UnmanagedType.LPArray, SizeParamIndex = 6)] EVENT_DATA_DESCRIPTOR[] UserData);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "FlushTraceW", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi)]
        public static extern Win32ErrorCode FlushTrace(
            [In] TRACEHANDLE SessionHandle,
            [In, MarshalAs(UnmanagedType.LPWStr)] string SessionName,
            [In, Out] ref EVENT_TRACE_PROPERTIES Properties);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "GetTraceEnableFlags", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
        public static extern uint GetTraceEnableFlags([In] TRACEHANDLE SessionHandle);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "GetTraceEnableLevel", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
        public static extern byte GetTraceEnableLevel([In] TRACEHANDLE SessionHandle);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "GetTraceLoggerHandle", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
        public static extern TRACEHANDLE GetTraceLoggerHandle([In] UINT_PTR Buffer);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "GetUserNameW", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
        [return: MarshalAs(UnmanagedType.Bool)]
        public static extern bool GetUserName(
            [Out] StringBuilder lpBuffer,
            [In, Out] ref uint lpnSize);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "ImpersonateAnonymousToken", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
        [return: MarshalAs(UnmanagedType.Bool)]
        public static extern bool ImpersonateAnonymousToken([In] HANDLE ThreadHandle);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "ImpersonateDdeClientWindow", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
        [return: MarshalAs(UnmanagedType.Bool)]
        public static extern bool ImpersonateDdeClientWindow(
            [In] HWND hWndClient,
            [In] HWND hWndServer);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "ImpersonateLoggedOnUser", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
        [return: MarshalAs(UnmanagedType.Bool)]
        public static extern bool ImpersonateLoggedOnUser([In] HANDLE hToken);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "ImpersonateNamedPipeClient", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
        [return: MarshalAs(UnmanagedType.Bool)]
        public static extern bool ImpersonateNamedPipeClient([In] HANDLE hNamedPipe);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "ImpersonateSelf", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
        [return: MarshalAs(UnmanagedType.Bool)]
        public static extern bool ImpersonateSelf([In] SECURITY_IMPERSONATION_LEVEL ImpersonationLevel);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "InitiateSystemShutdownW", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
        [return: MarshalAs(UnmanagedType.Bool)]
        public static extern bool InitiateSystemShutdown(
            [In] string lpMachineName,
            [In] string lpMessage,
            [In] uint dwTimeout,
            [In, MarshalAs(UnmanagedType.Bool)] bool bForceAppsClosed,
            [In, MarshalAs(UnmanagedType.Bool)] bool bRebootAfterShutdown);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "InitiateSystemShutdownExW", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
        [return: MarshalAs(UnmanagedType.Bool)]
        public static extern bool InitiateSystemShutdownEx(
            [In, MarshalAs(UnmanagedType.LPWStr)] string lpMachineName,
            [In, MarshalAs(UnmanagedType.LPWStr)] string lpMessage,
            [In] uint dwTimeout,
            [In, MarshalAs(UnmanagedType.Bool)] bool bForceAppsClosed,
            [In, MarshalAs(UnmanagedType.Bool)] bool bRebootAfterShutdown,
            [In] ShutdownReason dwReason);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "OpenSCManagerW", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
        public static extern SC_HANDLE OpenSCManager(
            [In, MarshalAs(UnmanagedType.LPWStr)] string lpMachineName,
            [In, MarshalAs(UnmanagedType.LPWStr)] string lpSCDB,
            [In] ServiceManagerAccessRights dwDesiredAccess);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "OpenServiceW", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
        public static extern SC_HANDLE OpenService(
            [In] SC_HANDLE hSCManager,
            [In, MarshalAs(UnmanagedType.LPWStr)] string lpSvcName,
            [In] ServiceAccessRights dwNumServiceArgs);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "OpenThreadToken", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
        [return: MarshalAs(UnmanagedType.Bool)]
        public static extern bool OpenThreadToken(
            [In] HANDLE ThreadHandle,
            [In] ThreadAccessRights DesiredAccess,
            [In, MarshalAs(UnmanagedType.Bool)] bool OpenAsSelf,
            [Out] out HANDLE TokenHandle);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "OpenTraceW", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
        public static extern TRACEHANDLE OpenTrace([In, Out] ref EVENT_TRACE_LOGFILE Logfile);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "ProcessTrace", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
        public static extern Win32ErrorCode ProcessTrace(
            [In, MarshalAs(UnmanagedType.LPArray, SizeParamIndex = 1)] TRACEHANDLE[] HandleArray,
            [In] uint HandleCount,
            [In] ref FILETIME StartTime,
            [In] ref FILETIME EndTime);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "QueryAllTracesW", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
        public static extern Win32ErrorCode QueryAllTraces(
            [Out, MarshalAs(UnmanagedType.LPArray, SizeParamIndex = 1)] EVENT_TRACE_PROPERTIES[] PropertyArray,
            [In] uint PropertyArrayCount,
            [Out] out uint SessionCount);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "QueryServiceConfigW", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
        [return: MarshalAs(UnmanagedType.Bool)]
        public static extern bool QueryServiceConfig(
            [In] SC_HANDLE hService,
            [Out, MarshalAs(UnmanagedType.LPArray, SizeParamIndex = 2)] byte[] lpBuffer,
            [In] uint cbBufSize,
            [Out] out uint pcbBytesNeeded);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "QueryServiceConfigW", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
        [return: MarshalAs(UnmanagedType.Bool)]
        public static extern bool QueryServiceConfig(
            [In] SC_HANDLE hService,
            [In] UINT_PTR lpBuffer,
            [In] uint cbBufSize,
            [Out] out uint pcbBytesNeeded);

        public static QUERY_SERVICE_CONFIG.Managed QueryServiceConfig(SC_HANDLE hService)
        {
            uint uiBytesNeeded = 0;
            if (!QueryServiceConfig(hService, UINT_PTR.Zero, 0, out uiBytesNeeded) &&
                KERNEL32.GetLastError() != Win32ErrorCode.ERROR_INSUFFICIENT_BUFFER)
            {
                throw new Win32Exception();
            }

            using (var allocGroup = new NativeHeapAllocationGroup())
            {
                UINT_PTR pBuffer = allocGroup.Alloc(uiBytesNeeded);

                if (!QueryServiceConfig(hService, pBuffer, uiBytesNeeded, out uiBytesNeeded))
                    throw new Win32Exception();

                var rawConfig = MarshalHelper.PtrToStructure<QUERY_SERVICE_CONFIG.Raw>(pBuffer);

                var managedConfig = new QUERY_SERVICE_CONFIG.Managed
                {
                    dwServiceType = rawConfig.dwServiceType,
                    dwStartType = rawConfig.dwStartType,
                    dwErrorControl = rawConfig.dwErrorControl,
                    lpBinaryPathName = Marshal.PtrToStringUni(rawConfig.lpBinaryPathName),
                    lpLoadOrderGroup = Marshal.PtrToStringUni(rawConfig.lpLoadOrderGroup),
                    dwTagId = rawConfig.dwTagId,
                    lpDependencies = Marshal.PtrToStringUni(rawConfig.lpDependencies),
                    lpServiceStartName = Marshal.PtrToStringUni(rawConfig.lpServiceStartName),
                    lpDisplayName = Marshal.PtrToStringUni(rawConfig.lpDisplayName),
                };

                return managedConfig;
            }
        }

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "QueryServiceConfig2W", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
        [return: MarshalAs(UnmanagedType.Bool)]
        public static extern bool QueryServiceConfig2(
            [In] SC_HANDLE hService,
            [In] ServiceConfigInfoLevel dwInfoLevel,
            [Out, MarshalAs(UnmanagedType.LPArray, SizeParamIndex = 3)] byte[] lpBuffer,
            [In] uint cbBufSize,
            [Out] out uint pcbBytesNeeded);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "QueryServiceStatusEx", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
        [return: MarshalAs(UnmanagedType.Bool)]
        public static extern bool QueryServiceStatusEx(
            [In] SC_HANDLE hService,
            [In] SC_STATUS_TYPE InfoLevel,
            [Out, MarshalAs(UnmanagedType.LPArray, SizeParamIndex = 3)] byte[] lpBuffer,
            [In] uint cbBufSize,
            [Out] out uint pcbBytesNeeded);

        public static void QueryServiceStatusEx(
            SC_HANDLE hService,
            [Out] out SERVICE_STATUS_PROCESS status)
        {
            status = new SERVICE_STATUS_PROCESS();
            byte[] buffer = status.GetBytes();
            uint uiBytesNeeded;
            if (!QueryServiceStatusEx(hService, SC_STATUS_TYPE.SC_STATUS_PROCESS_INFO, buffer, (uint)buffer.Length, out uiBytesNeeded))
                throw new Win32Exception();
            status = buffer.FromBytes<SERVICE_STATUS_PROCESS>();
            return;
        }

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "QueryTraceW", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi)]
        public static extern Win32ErrorCode QueryTrace(
            [Out, MarshalAs(UnmanagedType.LPArray, SizeParamIndex = 1)] EVENT_TRACE_PROPERTIES[] PropertyArray,
            [In] uint PropertyArrayCount,
            [Out] out uint SessionCount);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "RegCloseKey", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi)]
        //public static extern Win32ErrorCode RegCloseKey([In] HKEY hKey);
        public static extern Win32ErrorCode RegCloseKey([In] UINT_PTR hKey);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "RegConnectRegistryW", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi)]
        public static extern Win32ErrorCode RegConnectRegistry(
            [In] string lpMachineName,
            [In] HKEY hKey,
            [Out] out HKEY phkResult);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "RegCopyTreeW", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi)]
        public static extern Win32ErrorCode RegCopyTree(
            [In] HKEY hKeySrc,
            [In, MarshalAs(UnmanagedType.LPWStr)] string lpSubKey,
            [In] HKEY hKeyDest);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "RegCreateKeyExW", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi)]
        public static extern Win32ErrorCode RegCreateKeyEx(
            [In] HKEY hKey,
            [In] string lpSubKey,
            [In] uint Reserved,
            [In] string lpClass,
            [In] RegistryOption dwOptions,
            [In] REGSAM samDesired,
            [In] ref SECURITY_ATTRIBUTES lpSecurityAttributes,
            [Out] out HKEY phkResult,
            [Out] out RegistryCreationDisposition lpdwDisposition);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "RegCreateKeyTransactedW", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi)]
        public static extern Win32ErrorCode RegCreateKeyTransacted(
            [In] HKEY hKey,
            [In] string lpSubKey,
            [In] uint Reserved,
            [In] string lpClass,
            [In] RegistryOption dwOptions,
            [In] REGSAM samDesired,
            [In] ref SECURITY_ATTRIBUTES lpSecurityAttributes,
            [Out] out HKEY phkResult,
            [Out] out RegistryCreationDisposition lpdwDisposition,
            [In] HANDLE hTransaction,
            [In] UINT_PTR pExtendedParameter);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "RegDeleteKeyW", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi)]
        public static extern Win32ErrorCode RegDeleteKey(
            [In] HKEY hKey,
            [In, MarshalAs(UnmanagedType.LPWStr)] string lpSubKey);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "RegDeleteKeyExW", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi)]
        public static extern Win32ErrorCode RegDeleteKeyEx(
            [In] HKEY hKey,
            [In, MarshalAs(UnmanagedType.LPWStr)] string lpSubKey,
            [In] REGSAM samDesired,
            [In] uint Reserved);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "RegDeleteKeyTransactedW", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi)]
        public static extern Win32ErrorCode RegDeleteKeyTransacted(
            [In] HKEY hKey,
            [In, MarshalAs(UnmanagedType.LPWStr)] string lpSubKey,
            [In] REGSAM samDesired,
            [In] uint Reserved,
            [In] HANDLE hTransaction,
            [In] UINT_PTR pExtendedParameter);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "RegDeleteKeyValueW", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi)]
        public static extern Win32ErrorCode RegDeleteKeyValue(
            [In] HKEY hKey,
            [In, MarshalAs(UnmanagedType.LPWStr)] string lpSubKey,
            [In, MarshalAs(UnmanagedType.LPWStr)] string lpValueName);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "RegDeleteValueW", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi)]
        public static extern Win32ErrorCode RegDeleteValue(
            [In] HKEY hKey,
            [In, MarshalAs(UnmanagedType.LPWStr)] string lpValueName);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "RegDeleteTreeW", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi)]
        public static extern Win32ErrorCode RegDeleteTree(
            [In] HKEY hKey,
            [In, MarshalAs(UnmanagedType.LPWStr)] string lpSubKey);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "RegDisablePredefinedCache", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi)]
        public static extern Win32ErrorCode RegDisablePredefinedCache();

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "RegDisablePredefinedCacheEx", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi)]
        public static extern Win32ErrorCode RegDisablePredefinedCacheEx();

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "RegDisableReflectionKey", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi)]
        public static extern Win32ErrorCode RegDisableReflectionKey([In] HKEY hKey);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "RegEnableReflectionKey", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi)]
        public static extern Win32ErrorCode RegEnableReflectionKey([In] HKEY hKey);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "RegEnumKeyW", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi)]
        public static extern Win32ErrorCode RegEnumKey(
            [In] HKEY hKey,
            [In] uint dwIndex,
            [Out] StringBuilder lpName,
            [In, Out] ref uint lpcName,
            [In] UINT_PTR lpReserved,
            [In, Out] StringBuilder lpClass,
            [In, Out] ref uint lpcClass,
            [Out] out FILETIME lpftLastWriteTime);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "RegEnumValueW", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi)]
        public static extern Win32ErrorCode RegEnumValue(
            [In] HKEY hKey,
            [In] uint dwIndex,
            [Out] StringBuilder lpValueName,
            [In, Out] ref uint lpcchValueName,
            [In] UINT_PTR lpReserved,
            [Out] out RegistryValueType lpType,
            [Out, MarshalAs(UnmanagedType.LPArray, SizeParamIndex = 7)] byte[] lpData,
            [In, Out] ref uint lpcbData);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "RegFlushKey", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi)]
        public static extern Win32ErrorCode RegFlushKey([In] HKEY hKey);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "RegGetKeySecurity", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi)]
        public static extern Win32ErrorCode RegGetKeySecurity(
            [In] HKEY hKey,
            [In] SECURITY_INFORMATION SecurityInformation,
            [Out, MarshalAs(UnmanagedType.LPArray, SizeParamIndex = 3)] byte[] pSecurityDescriptor,
            [In, Out] ref uint lpcbSecurityDescriptor);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "RegGetValueW", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi)]
        public static extern Win32ErrorCode RegGetValue(
            [In] HKEY hKey,
            [In] string lpSubKey,
            [In] string lpValue,
            [In] RegGetValueFlags dwFlags,
            [Out] out uint pdwType,
            [Out] byte[] pvData,
            [In, Out] ref uint pcbData);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "RegisterServiceCtrlHandlerExW", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
        public static extern SERVICE_STATUS_HANDLE RegisterServiceCtrlHandlerEx(
            [In] string lpServiceName,
            [In] HANDLER_FUNCTION_EX lpHandlerProc,
            [In] UINT_PTR lpContext);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "RegisterTraceGuidsW", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi)]
        public static extern Win32ErrorCode RegisterTraceGuids(
            [In] WMIDPREQUEST RequestAddress,
            [In] UINT_PTR RequestContext,
            [In, MarshalAs(UnmanagedType.LPStruct)] Guid ControlGuid,
            [In] uint GuidCount,
            [In, Out, MarshalAs(UnmanagedType.LPArray, SizeParamIndex = 3)] TRACE_GUID_REGISTRATION[] TraceGuidReg,
            [In, MarshalAs(UnmanagedType.LPWStr)] string MofImagePath,
            [In, MarshalAs(UnmanagedType.LPWStr)] string MofResourceName,
            [Out] out TRACEHANDLE RegistrationHandle);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "RegLoadKeyW", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi)]
        public static extern Win32ErrorCode RegLoadKey(
            [In] HKEY hKey,
            [In, MarshalAs(UnmanagedType.LPWStr)] string lpSubKey,
            [In, MarshalAs(UnmanagedType.LPWStr)] string lpFile);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "RegLoadMUIStringW", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi)]
        public static extern Win32ErrorCode RegLoadMUIString(
            [In] HKEY hKey,
            [In, MarshalAs(UnmanagedType.LPWStr)] string pszValue,
            [Out] StringBuilder pszOutBuf,
            [In] uint cbOutBuf,
            [Out] out uint pcbData,
            [In] uint Flags,
            [In, MarshalAs(UnmanagedType.LPWStr)] string pszDirectory);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "RegNotifyChangeKeyValue", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi)]
        public static extern Win32ErrorCode RegNotifyChangeKeyValue(
            [In] HKEY hKey,
            [In, MarshalAs(UnmanagedType.Bool)] bool bWatchSubtree,
            [In] RegistryNotifyChangeFlags dwNotifyFilter,
            [In] HANDLE hEvent,
            [In, MarshalAs(UnmanagedType.Bool)] bool fAsynchronous);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "RegOpenCurrentUser", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi)]
        public static extern Win32ErrorCode RegOpenCurrentUser(
            [In] REGSAM samDesired,
            [Out] out HKEY hKey);

        /// <param name="ulOptions">This parameter is reserved and must be zero.</param>
        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "RegOpenKeyExW", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi)]
        public static extern Win32ErrorCode RegOpenKeyEx(
            [In] HKEY hKey,
            [In, MarshalAs(UnmanagedType.LPWStr)] string lpSubKey,
            [In] uint ulOptions,
            [In] REGSAM samDesired,
            [Out] out HKEY phkResult);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "RegOpenKeyTransactedW", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi)]
        public static extern Win32ErrorCode RegOpenKeyTransacted(
            [In] HKEY hKey,
            [In] string lpSubKey,
            [In] RegistryOption ulOptions,
            [In] REGSAM samDesired,
            [Out] out HKEY phkResult,
            [In] HANDLE hTransaction,
            [In] UINT_PTR pExtendedParameter);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "RegOpenUserClassesRoot", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi)]
        public static extern Win32ErrorCode RegOpenUserClassesRoot(
            [In] HANDLE hToken,
            [In] uint Reserved,
            [In] REGSAM samDesired,
            [Out] out HKEY phkResult);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "RegOverridePredefKey", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi)]
        public static extern Win32ErrorCode RegOverridePredefKey(
            [In] HKEY hKey,
            [In] HKEY hNewHKey);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "RegQueryInfoKeyW", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi)]
        public static extern Win32ErrorCode RegQueryInfoKey(
            [In] HKEY hKey,
            [Out] StringBuilder lpClass,
            [In, Out] ref uint lpcClass,
            [In] UINT_PTR lpReserved,
            [Out] out uint lpcSubKeys,
            [Out] out uint lpcMaxSubKeyLen,
            [Out] out uint lpcMaxClassLen,
            [Out] out uint lpcValues,
            [Out] out uint lpcMaxValueNameLen,
            [Out] out uint lpcMaxValueLen,
            [Out] out uint lpcbSecurityDescriptor,
            [Out] out FILETIME lpftLastWriteTime);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "RegQueryMultipleValuesW", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi)]
        public static extern Win32ErrorCode RegQueryMultipleValues(
            [In] HKEY hKey,
            [Out, MarshalAs(UnmanagedType.LPArray, SizeParamIndex = 2)] VALENT[] val_list,
            [In] uint num_vals,
            [Out, MarshalAs(UnmanagedType.LPArray, SizeParamIndex = 4)] byte[] lpValueBuf,
            [In, Out] ref uint ldwTotsize);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "RegQueryReflectionKey", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi)]
        public static extern Win32ErrorCode RegQueryReflectionKey(
            [In] HKEY hBase,
            [Out, MarshalAs(UnmanagedType.Bool)] out bool bIsReflectionDisabled);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "RegQueryValueExW", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi)]
        public static extern Win32ErrorCode RegQueryValueEx(
            [In] HKEY hKey,
            [In] string lpValueName,
            [In] UINT_PTR lpReserved,
            [Out] out RegistryValueType lpType,
            [Out] byte[] pvData,
            [In, Out] ref uint lpcbData);

        /// <summary>
        /// Convenient overload of the Win32 RegQueryValueEx function,
        /// which returns null if the value doesn't exist,
        /// and throws an exception when it encounters any other error.
        /// </summary>
        /// <param name="hKey"></param>
        /// <param name="lpValueName"></param>
        /// <param name="lpType"></param>
        /// <returns></returns>
        public static byte[] RegQueryValueEx(
            [In] HKEY hKey,
            [In] string lpValueName,
            [Out] out RegistryValueType lpType)
        {
            Win32ErrorCode errorCode;
            uint uiSize = 0;
            byte[] buffer = null;

            /// First call is a basic query.
            errorCode = RegQueryValueEx(hKey, lpValueName, 0, out lpType, null, ref uiSize);

            /// This is the easy case because it tells us exactly how much to allocate.
            if (errorCode == Win32ErrorCode.ERROR_SUCCESS)
            {
                buffer = new byte[uiSize];
                errorCode = RegQueryValueEx(hKey, lpValueName, 0, out lpType, buffer, ref uiSize);
                errorCode.TryThrowWin32Exception();
                return buffer;
            }

            /// We're gonna have to reallocate until we're big enough.
            /// This wastefulness is the norm for HKEY_PERFORMANCE_DATA.
            else if (errorCode == Win32ErrorCode.ERROR_MORE_DATA)
            {
                uiSize = 1000;
                do
                {
                    uiSize *= 2;
                    buffer = new byte[uiSize];
                }
                while ((errorCode = RegQueryValueEx(hKey, lpValueName, 0, out lpType, buffer, ref uiSize)) == Win32ErrorCode.ERROR_MORE_DATA);
                errorCode.TryThrowWin32Exception();
                return buffer.Subarray(0, (long)uiSize);
            }

            else
            {
                throw new Win32Exception();
            }
        }

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "RegReplaceKeyW", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi)]
        public static extern Win32ErrorCode RegReplaceKey(
            [In] HKEY hKey,
            [In, MarshalAs(UnmanagedType.LPWStr)] string lpSubKey,
            [In, MarshalAs(UnmanagedType.LPWStr)] string lpNewFile,
            [In, MarshalAs(UnmanagedType.LPWStr)] string lpOldFile);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "RegRestoreKeyW", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi)]
        public static extern Win32ErrorCode RegRestoreKey(
            [In] HKEY hKey,
            [In, MarshalAs(UnmanagedType.LPWStr)] string lpFile,
            [In, MarshalAs(UnmanagedType.LPWStr)] RegRestoreKeyLoadHiveFlags dwFlags);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "RegSaveKeyW", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi)]
        public static extern Win32ErrorCode RegSaveKey(
            [In] HKEY hKey,
            [In, MarshalAs(UnmanagedType.LPWStr)] string lpFile,
            [In] ref SECURITY_ATTRIBUTES lpSecurityAttributes);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "RegSaveKeyExW", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi)]
        public static extern Win32ErrorCode RegSaveKeyEx(
            [In] HKEY hKey,
            [In, MarshalAs(UnmanagedType.LPWStr)] string lpFile,
            [In] ref SECURITY_ATTRIBUTES lpSecurityAttributes,
            [In] RegSaveKeyFlags Flags);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "RegSetKeySecurity", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi)]
        public static extern Win32ErrorCode RegSetKeySecurity(
            [In] HKEY hKey,
            [In] ref SECURITY_INFORMATION SecurityInformation,
            [In, MarshalAs(UnmanagedType.LPArray)] byte[] pSecurityDescriptor);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "RegSetKeyValueW", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi)]
        public static extern Win32ErrorCode RegSetKeyValue(
            [In] HKEY hKey,
            [In, MarshalAs(UnmanagedType.LPWStr)] string lpSubKey,
            [In, MarshalAs(UnmanagedType.LPWStr)] string lpValueName,
            [In] RegistryValueType dwType,
            [In, MarshalAs(UnmanagedType.LPArray, SizeParamIndex = 5)] byte[] lpData,
            [In] uint cbData);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "RegSetValueExW", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi)]
        public static extern Win32ErrorCode RegSetValueEx(
            [In] HKEY hKey,
            [In, MarshalAs(UnmanagedType.LPWStr)] string lpValueName,
            [In] uint Reserved,
            [In] RegistryValueType dwType,
            [In, MarshalAs(UnmanagedType.LPArray, SizeParamIndex = 5)] byte[] lpData,
            [In] uint cbData);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "RegUnLoadKeyW", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi)]
        public static extern Win32ErrorCode RegUnLoadKey(
            [In] HKEY hKey,
            [In, MarshalAs(UnmanagedType.LPWStr)] string lpSubKey);

        [Obsolete]
        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "RemoveTraceCallback", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi)]
        public static extern Win32ErrorCode RemoveTraceCallback([In, MarshalAs(UnmanagedType.LPStruct)] Guid pGuid);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "RevertToSelf", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
        [return: MarshalAs(UnmanagedType.Bool)]
        public static extern bool RevertToSelf();

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "SetServiceStatus", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
        [return: MarshalAs(UnmanagedType.Bool)]
        public static extern bool SetServiceStatus(
            [In] SC_HANDLE hServiceStatus,
            [In] ref SERVICE_STATUS lpServiceStatus);

        [Obsolete]
        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "SetTraceCallback", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi)]
        public static extern Win32ErrorCode SetTraceCallback(
            [In, MarshalAs(UnmanagedType.LPStruct)] Guid pGuid,
            [In] EVENT_CALLBACK EventCallback);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "SetThreadToken", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
        public static extern bool SetThreadToken(
            [In] ref HANDLE Thread,
            [In] HANDLE hToken);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "SetThreadToken", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
        public static extern bool SetThreadToken(
            [In] UINT_PTR Thread,
            [In] HANDLE hToken);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "StartService", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
        [return: MarshalAs(UnmanagedType.Bool)]
        public static extern bool StartService(
            SC_HANDLE hService,
            int dwNumServiceArgs,
            [In, MarshalAs(UnmanagedType.LPArray, SizeParamIndex = 1)] params string[] lpServiceArgVectors);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "StartServiceCtrlDispatcherW", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
        [return: MarshalAs(UnmanagedType.Bool)]
        public static extern bool StartServiceCtrlDispatcher(
            [In, MarshalAs(UnmanagedType.LPArray)] SERVICE_TABLE_ENTRY[] lpServiceTable);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "StartTraceW", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
        public static extern Win32ErrorCode StartTrace(
            [Out] out TRACEHANDLE SessionHandle,
            [In, MarshalAs(UnmanagedType.LPWStr)] string SessionName,
            [In, Out] ref EVENT_TRACE_PROPERTIES Properties);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "StopTraceW", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
        public static extern Win32ErrorCode StopTrace(
            [Out] out TRACEHANDLE SessionHandle,
            [In, MarshalAs(UnmanagedType.LPWStr)] string SessionName,
            [In, Out] ref EVENT_TRACE_PROPERTIES Properties);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "TraceEvent", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi)]
        public static extern Win32ErrorCode TraceEvent(
            [In] TRACEHANDLE SessionHandle,
            [In, MarshalAs(UnmanagedType.LPArray)] byte[] EventTrace);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "TraceEventInstance", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi)]
        public static extern Win32ErrorCode TraceEventInstance(
            [In] TRACEHANDLE SessionHandle,
            [In, MarshalAs(UnmanagedType.LPArray)] byte[] EventTrace,
            [In] ref EVENT_INSTANCE_INFO pInstInfo,
            [In] ref EVENT_INSTANCE_INFO pParentInstInfo);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "TraceEventInstance", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi)]
        public static extern Win32ErrorCode TraceMessage(
            [In] TRACEHANDLE SessionHandle,
            [In] TraceMessageFlags MessageFlags,
            [In, MarshalAs(UnmanagedType.LPStruct)] Guid MessageGuid,
            [In] ushort MessageNumber);

        /*[DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "TraceMessageVa", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi)]
        public static extern Win32ErrorCode TraceMessageVa(
            [In] TRACEHANDLE SessionHandle,
            [In] TraceMessageFlags MessageFlags,
            [In, MarshalAs(UnmanagedType.LPStruct)] Guid MessageGuid,
            [In] ushort MessageNumber,
            [In] va_list MessageArgList);*/

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "TraceSetInformation", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi)]
        public static extern Win32ErrorCode TraceSetInformation(
            [In] TRACEHANDLE SessionHandle,
            [In] TRACE_QUERY_INFO_CLASS InformationClass,
            [In, MarshalAs(UnmanagedType.LPArray, SizeParamIndex = 3)] byte[] TraceInformation,
            [In] uint InformationLength);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "UpdateTraceW", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi)]
        public static extern Win32ErrorCode UpdateTrace(
            [In] TRACEHANDLE SessionHandle,
            [In, MarshalAs(UnmanagedType.LPWStr)] string SessionName,
            [In, Out] ref EVENT_TRACE_PROPERTIES Properties);

        [DllImport(Constants.ModuleNames.ADVAPI32, EntryPoint = "UpdateTraceGuids", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Winapi)]
        public static extern Win32ErrorCode UpdateTraceGuids([In] TRACEHANDLE RegistrationHandle);
    }
}

/*
Microsoft (R) COFF/PE Dumper Version 10.00.40219.01
Copyright (C) Microsoft Corporation.  All rights reserved.


Dump of file c:\Windows\System32\advapi32.dll

File Type: DLL

  Section contains the following exports for ADVAPI32.dll

    00000000 characteristics
    4A5BD44A time date stamp Mon Jul 13 19:41:46 2009
        0.00 version
        1000 ordinal base
         806 number of functions
         805 number of names

    ordinal hint RVA      name

       1002    0          A_SHAFinal (forwarded to NTDLL.A_SHAFinal)
       1003    1          A_SHAInit (forwarded to NTDLL.A_SHAInit)
       1004    2          A_SHAUpdate (forwarded to NTDLL.A_SHAUpdate)
       1005    3 00068480 AbortSystemShutdownA
       1006    4 00062F80 AbortSystemShutdownW
       1007    5 00011870 AccessCheck
       1008    6 00054C50 AccessCheckAndAuditAlarmA
       1009    7 0003BD48 AccessCheckAndAuditAlarmW
       1010    8 0000BB38 AccessCheckByType
       1011    9 00054A70 AccessCheckByTypeAndAuditAlarmA
       1012    A 0003BCA0 AccessCheckByTypeAndAuditAlarmW
       1013    B 0003BC34 AccessCheckByTypeResultList
       1014    C 00054890 AccessCheckByTypeResultListAndAuditAlarmA
       1015    D 000546A0 AccessCheckByTypeResultListAndAuditAlarmByHandleA
       1016    E 0003BB80 AccessCheckByTypeResultListAndAuditAlarmByHandleW
       1017    F 0003BACC AccessCheckByTypeResultListAndAuditAlarmW
       1018   10 0001B5BC AddAccessAllowedAce
       1019   11 00011E6C AddAccessAllowedAceEx
       1020   12 0003BA94 AddAccessAllowedObjectAce
       1021   13 0003BA88 AddAccessDeniedAce
       1022   14 0003BA68 AddAccessDeniedAceEx
       1023   15 0003BA30 AddAccessDeniedObjectAce
       1024   16 0000C760 AddAce
       1025   17 000010C0 AddAuditAccessAce
       1026   18 0003B9FC AddAuditAccessAceEx
       1027   19 0003B9A8 AddAuditAccessObjectAce
       1028   1A 000402E8 AddConditionalAce
       1029   1B          AddMandatoryAce (forwarded to KERNELBASE.AddMandatoryAce)
       1030   1C 00061100 AddUsersToEncryptedFile
       1031   1D 00061070 AddUsersToEncryptedFileEx
       1032   1E 0003B980 AdjustTokenGroups
       1033   1F 0001B9B0 AdjustTokenPrivileges
       1034   20 0001B63C AllocateAndInitializeSid
       1035   21 000010A4 AllocateLocallyUniqueId
       1036   22 0003B96C AreAllAccessesGranted
       1037   23 0003B960 AreAnyAccessesGranted
       1038   24 0000BDD0 AuditComputeEffectivePolicyBySid
       1039   25 000609D0 AuditComputeEffectivePolicyByToken
       1040   26 000537C0 AuditEnumerateCategories
       1041   27 00049560 AuditEnumeratePerUserPolicy
       1042   28 0000BF30 AuditEnumerateSubCategories
       1043   29 00020C10 AuditFree
       1044   2A 000494B0 AuditLookupCategoryGuidFromCategoryId
       1045   2B 000494F0 AuditLookupCategoryIdFromCategoryGuid
       1046   2C 00060940 AuditLookupCategoryNameA
       1047   2D 00053680 AuditLookupCategoryNameW
       1048   2E 000608B0 AuditLookupSubCategoryNameA
       1049   2F 00053560 AuditLookupSubCategoryNameW
       1050   30 0003D608 AuditQueryGlobalSaclA
       1051   31 0003D6C0 AuditQueryGlobalSaclW
       1052   32 000495C0 AuditQueryPerUserPolicy
       1053   33 00049410 AuditQuerySecurity
       1054   34 0000BD30 AuditQuerySystemPolicy
       1055   35 0003D724 AuditSetGlobalSaclA
       1056   36 0000C038 AuditSetGlobalSaclW
       1057   37 00049660 AuditSetPerUserPolicy
       1058   38 00053460 AuditSetSecurity
       1059   39 0000BEB0 AuditSetSystemPolicy
       1060   3A 000675D0 BackupEventLogA
       1061   3B 00061D80 BackupEventLogW
       1062   3C 00001AC0 BuildExplicitAccessWithNameA
       1063   3D 00001AC0 BuildExplicitAccessWithNameW
       1064   3E 000455C0 BuildImpersonateExplicitAccessWithNameA
       1065   3F 000455C0 BuildImpersonateExplicitAccessWithNameW
       1066   40 000452A0 BuildImpersonateTrusteeA
       1067   41 000452A0 BuildImpersonateTrusteeW
       1068   42 00065010 BuildSecurityDescriptorA
       1069   43 00005E80 BuildSecurityDescriptorW
       1070   44 00001AF0 BuildTrusteeWithNameA
       1071   45 00001AF0 BuildTrusteeWithNameW
       1072   46 00045180 BuildTrusteeWithObjectsAndNameA
       1073   47 00045180 BuildTrusteeWithObjectsAndNameW
       1074   48 000451D0 BuildTrusteeWithObjectsAndSidA
       1075   49 000451D0 BuildTrusteeWithObjectsAndSidW
       1076   4A 00045280 BuildTrusteeWithSidA
       1077   4B 00045280 BuildTrusteeWithSidW
       1078   4C 00050B70 CancelOverlappedAccess
       1079   4D 0003B954 ChangeServiceConfig2A
       1080   4E 0003B948 ChangeServiceConfig2W
       1081   4F 0003B8DC ChangeServiceConfigA
       1082   50 0003B870 ChangeServiceConfigW
       1083   51 0000D980 CheckTokenMembership
       1084   52 00067640 ClearEventLogA
       1085   53 00061F00 ClearEventLogW
       1086   54 0001F660 CloseCodeAuthzLevel
       1087   55 0004A140 CloseEncryptedFileRaw
       1088   56 00006D90 CloseEventLog
       1089   57 00017E04 CloseServiceHandle
       1090   58 0003ED20 CloseThreadWaitChainSession
       1091   59 000111D0 CloseTrace
       1092   5A 00024890 CommandLineFromMsiDescriptor
       1093   5B 0001F9B0 ComputeAccessTokenFromCodeAuthzLevel
       1094   5C 00023BD8 ControlService
       1095   5D 0003B860 ControlServiceExA
       1096   5E 0003B850 ControlServiceExW
       1097   5F 000635F0 ControlTraceA
       1098   60 0000FAD0 ControlTraceW
       1099   61 0005CCC0 ConvertAccessToSecurityDescriptorA
       1100   62 00050E70 ConvertAccessToSecurityDescriptorW
       1101   63 00074840 ConvertSDToStringSDRootDomainA
       1102   64 000747D0 ConvertSDToStringSDRootDomainW
       1103   65 00064AC0 ConvertSecurityDescriptorToAccessA
       1104   66 00064AC0 ConvertSecurityDescriptorToAccessNamedA
       1105   67 0005CA80 ConvertSecurityDescriptorToAccessNamedW
       1106   68 0005CA80 ConvertSecurityDescriptorToAccessW
       1107   69 000744D0 ConvertSecurityDescriptorToStringSecurityDescriptorA
       1108   6A 00074420 ConvertSecurityDescriptorToStringSecurityDescriptorW
       1109   6B 0004CD10 ConvertSidToStringSidA
       1110   6C 0001BF70 ConvertSidToStringSidW
       1111   6D 00073BB0 ConvertStringSDToSDDomainA
       1112   6E 00073AF0 ConvertStringSDToSDDomainW
       1113   6F 00073D30 ConvertStringSDToSDRootDomainA
       1114   70 00073CC0 ConvertStringSDToSDRootDomainW
       1115   71 0000D710 ConvertStringSecurityDescriptorToSecurityDescriptorA
       1116   72 00012040 ConvertStringSecurityDescriptorToSecurityDescriptorW
       1117   73 00021860 ConvertStringSidToSidA
       1118   74 00020EC0 ConvertStringSidToSidW
       1119   75 0003B828 ConvertToAutoInheritPrivateObjectSecurity
       1120   76 0001BDA0 CopySid
       1121   77 00069900 CreateCodeAuthzLevel
       1122   78 00024A20 CreatePrivateObjectSecurity
       1123   79 0000F938 CreatePrivateObjectSecurityEx
       1124   7A 0003B7D8 CreatePrivateObjectSecurityWithMultipleInheritance
       1125   7B 0004A1A0 CreateProcessAsUserA
       1126   7C 0000AFE8 CreateProcessAsUserW
       1127   7D 0006FA50 CreateProcessWithLogonW
       1128   7E 0006F9E0 CreateProcessWithTokenW
       1129   7F 0003B784 CreateRestrictedToken
       1130   80 0003B704 CreateServiceA
       1131   81 00023B44 CreateServiceW
       1132   82          CreateTraceInstanceId (forwarded to ntdll.EtwCreateTraceInstanceId)
       1133   83 0000DD34 CreateWellKnownSid
       1134   84 0006A460 CredBackupCredentials
       1135   85 00060590 CredDeleteA
       1136   86 000604D0 CredDeleteW
       1137   87 0006A310 CredEncryptAndMarshalBinaryBlob
       1138   88 0006D080 CredEnumerateA
       1139   89 0006CF50 CredEnumerateW
       1140   8A 0006CA00 CredFindBestCredentialA
       1141   8B 0006C8F0 CredFindBestCredentialW
       1142   8C 00020C10 CredFree
       1143   8D 000530F0 CredGetSessionTypes
       1144   8E 000603D0 CredGetTargetInfoA
       1145   8F 000602D0 CredGetTargetInfoW
       1146   90 00066170 CredIsMarshaledCredentialA
       1147   91 00022E60 CredIsMarshaledCredentialW
       1148   92 0006A120 CredIsProtectedA
       1149   93 0000C230 CredIsProtectedW
       1150   94 00060270 CredMarshalCredentialA
       1151   95 00007A30 CredMarshalCredentialW
       1152   96 00004750 CredProfileLoaded
       1153   97 00022C70 CredProfileUnloaded
       1154   98 0006C680 CredProtectA
       1155   99 00007800 CredProtectW
       1156   9A 0006D2C0 CredReadA
       1157   9B 0006C7D0 CredReadByTokenHandle
       1158   9C 0006CC40 CredReadDomainCredentialsA
       1159   9D 0006CB10 CredReadDomainCredentialsW
       1160   9E 0006D1B0 CredReadW
       1161   9F 00049220 CredRenameA
       1162   A0 00049220 CredRenameW
       1163   A1 0006A340 CredRestoreCredentials
       1164   A2 000601E0 CredUnmarshalCredentialA
       1165   A3 0000C1A0 CredUnmarshalCredentialW
       1166   A4 0006A1A0 CredUnprotectA
       1167   A5 00006450 CredUnprotectW
       1168   A6 0006D480 CredWriteA
       1169   A7 0006CE50 CredWriteDomainCredentialsA
       1170   A8 0006CD70 CredWriteDomainCredentialsW
       1171   A9 0006D3D0 CredWriteW
       1172   AA 0006A740 CredpConvertCredential
       1173   AB 00060650 CredpConvertOneCredentialSize
       1174   AC 00053210 CredpConvertTargetInfo
       1175   AD 000607F0 CredpDecodeCredential
       1176   AE 00060840 CredpEncodeCredential
       1177   AF 00066140 CredpEncodeSecret
       1178   B0 00008180 CryptAcquireContextA
       1179   B1 0000D98C CryptAcquireContextW
       1180   B2 0003B6F8 CryptContextAddRef
       1181   B3 0000DAD4 CryptCreateHash
       1182   B4 0003B6D0 CryptDecrypt
       1183   B5 0003B6B0 CryptDeriveKey
       1184   B6 0000DB00 CryptDestroyHash
       1185   B7 0000AFA0 CryptDestroyKey
       1186   B8 0003B69C CryptDuplicateHash
       1187   B9 0003B690 CryptDuplicateKey
       1188   BA 0003B650 CryptEncrypt
       1189   BB 0003B628 CryptEnumProviderTypesA
       1190   BC 0003B600 CryptEnumProviderTypesW
       1191   BD 0003B5D8 CryptEnumProvidersA
       1192   BE 0003B5B0 CryptEnumProvidersW
       1193   BF 00008140 CryptExportKey
       1194   C0 000019BC CryptGenKey
       1195   C1 0000DC60 CryptGenRandom
       1196   C2 0003B590 CryptGetDefaultProviderA
       1197   C3 0003B570 CryptGetDefaultProviderW
       1198   C4 0000DB20 CryptGetHashParam
       1199   C5 0003B554 CryptGetKeyParam
       1200   C6 0003B538 CryptGetProvParam
       1201   C7 0003B52C CryptGetUserKey
       1202   C8 0000DAC0 CryptHashData
       1203   C9 0003B520 CryptHashSessionKey
       1204   CA 0000AF6C CryptImportKey
       1205   CB 0000DD10 CryptReleaseContext
       1206   CC 0003B514 CryptSetHashParam
       1207   CD 0003B508 CryptSetKeyParam
       1208   CE 0003B4FC CryptSetProvParam
       1209   CF 0003B4F0 CryptSetProviderA
       1210   D0 0003B4DC CryptSetProviderExA
       1211   D1 0003B4D0 CryptSetProviderExW
       1212   D2 0003B4C4 CryptSetProviderW
       1213   D3 0003B49C CryptSignHashA
       1214   D4 0003B474 CryptSignHashW
       1215   D5 0003B44C CryptVerifySignatureA
       1216   D6 0000AFB4 CryptVerifySignatureW
       1217   D7 00061550 DecryptFileA
       1218   D8 000614E0 DecryptFileW
       1219   D9 0001B610 DeleteAce
       1220   DA 00023BC4 DeleteService
       1221   DB 00017D30 DeregisterEventSource
       1222   DC 0000F924 DestroyPrivateObjectSecurity
       1223   DD 00060F60 DuplicateEncryptionInfoFile
       1224   DE 0000D358 DuplicateToken
       1225   DF 0000D310 DuplicateTokenEx
       1226   E0 00056920 ElfBackupEventLogFileA
       1227   E1 00056EC0 ElfBackupEventLogFileW
       1228   E2 00057170 ElfChangeNotify
       1229   E3 000569E0 ElfClearEventLogFileA
       1230   E4 00056F80 ElfClearEventLogFileW
       1231   E5 00006DC0 ElfCloseEventLog
       1232   E6 00017D60 ElfDeregisterEventSource
       1233   E7 0004C460 ElfFlushEventLog
       1234   E8 000572F0 ElfNumberOfRecords
       1235   E9 00057240 ElfOldestRecord
       1236   EA 00056A80 ElfOpenBackupEventLogA
       1237   EB 00057020 ElfOpenBackupEventLogW
       1238   EC 00056BB0 ElfOpenEventLogA
       1239   ED 00006AF0 ElfOpenEventLogW
       1240   EE 000567E0 ElfReadEventLogA
       1241   EF 00056D80 ElfReadEventLogW
       1242   F0 00026D20 ElfRegisterEventSourceA
       1243   F1 000132C0 ElfRegisterEventSourceW
       1244   F2 00056650 ElfReportEventA
       1245   F3 00042480 ElfReportEventAndSourceW
       1246   F4 0000E1F0 ElfReportEventW
       1247   F5 00010230 EnableTrace
       1248   F6 00010150 EnableTraceEx
       1249   F7 0000FF10 EnableTraceEx2
       1250   F8 00061670 EncryptFileA
       1251   F9 00061610 EncryptFileW
       1252   FA 00060E90 EncryptedFileKeyInfo
       1253   FB 00060F10 EncryptionDisable
       1254   FC 0004CE80 EnumDependentServicesA
       1255   FD 00001440 EnumDependentServicesW
       1256   FE 0004D3C0 EnumServiceGroupW
       1257   FF 0004D1F0 EnumServicesStatusA
       1258  100 0004CFF0 EnumServicesStatusExA
       1259  101 0000C570 EnumServicesStatusExW
       1260  102 0004D5F0 EnumServicesStatusW
       1261  103 0000D510 EnumerateTraceGuids
       1262  104 00003E60 EnumerateTraceGuidsEx
       1263  105 0003B440 EqualDomainSid
       1264  106 00008408 EqualPrefixSid
       1265  107 0001B820 EqualSid
       1266  108 00001C10 EventAccessControl
       1267  109 00002020 EventAccessQuery
       1268  10A 0004FC20 EventAccessRemove
       1269  10B          EventActivityIdControl (forwarded to ntdll.EtwEventActivityIdControl)
       1270  10C          EventEnabled (forwarded to ntdll.EtwEventEnabled)
       1271  10D          EventProviderEnabled (forwarded to ntdll.EtwEventProviderEnabled)
       1272  10E          EventRegister (forwarded to ntdll.EtwEventRegister)
       1273  10F          EventUnregister (forwarded to ntdll.EtwEventUnregister)
       1274  110          EventWrite (forwarded to ntdll.EtwEventWrite)
       1275  111          EventWriteEndScenario (forwarded to ntdll.EtwEventWriteEndScenario)
       1276  112 0003B400 EventWriteEx
       1277  113          EventWriteStartScenario (forwarded to ntdll.EtwEventWriteStartScenario)
       1278  114          EventWriteString (forwarded to ntdll.EtwEventWriteString)
       1279  115          EventWriteTransfer (forwarded to ntdll.EtwEventWriteTransfer)
       1280  116 00061420 FileEncryptionStatusA
       1281  117 000613D0 FileEncryptionStatusW
       1282  118 0003B3F0 FindFirstFreeAce
       1283  119 00060D90 FlushEfsCache
       1284  11A 000686E0 FlushTraceA
       1285  11B 00004AE0 FlushTraceW
       1286  11C 0004A0E0 FreeEncryptedFileKeyInfo
       1287  11D 0004A050 FreeEncryptedFileMetadata
       1288  11E 0004A110 FreeEncryptionCertificateHashList
       1289  11F 000452C0 FreeInheritedFromArray
       1290  120 0001B818 FreeSid
       1291  121 00064820 GetAccessPermissionsForObjectA
       1292  122 0005C360 GetAccessPermissionsForObjectW
       1293  123 00011E14 GetAce
       1294  124 0000E3B0 GetAclInformation
       1295  125 0005E480 GetAuditedPermissionsFromAclA
       1296  126 00045600 GetAuditedPermissionsFromAclW
       1297  127 00061720 GetCurrentHwProfileA
       1298  128 00001150 GetCurrentHwProfileW
       1299  129 0005E500 GetEffectiveRightsFromAclA
       1300  12A 000456F0 GetEffectiveRightsFromAclW
       1301  12B 0004A0B0 GetEncryptedFileMetadata
       1302  12C 00006E50 GetEventLogInformation
       1303  12D 00051150 GetExplicitEntriesFromAclA
       1304  12E 000456A0 GetExplicitEntriesFromAclW
       1305  12F 00054160 GetFileSecurityA
       1306  130 00007D00 GetFileSecurityW
       1307  131 00007EA0 GetInformationCodeAuthzLevelW
       1308  132 000086C0 GetInformationCodeAuthzPolicyW
       1309  133 00045300 GetInheritanceSourceA
       1310  134 00045310 GetInheritanceSourceW
       1311  135 00011E40 GetKernelObjectSecurity
       1312  136 0001B580 GetLengthSid
       1313  137 0005F710 GetLocalManagedApplicationData
       1314  138 0005F940 GetLocalManagedApplications
       1315  139 00052B80 GetManagedApplicationCategories
       1316  13A 0005F6F0 GetManagedApplications
       1317  13B 000450F0 GetMultipleTrusteeA
       1318  13C 00045110 GetMultipleTrusteeOperationA
       1319  13D 00045110 GetMultipleTrusteeOperationW
       1320  13E 000450F0 GetMultipleTrusteeW
       1321  13F 0005E600 GetNamedSecurityInfoA
       1322  140 00064D70 GetNamedSecurityInfoExA
       1323  141 0005DF00 GetNamedSecurityInfoExW
       1324  142 0000F990 GetNamedSecurityInfoW
       1325  143 000620D0 GetNumberOfEventLogRecords
       1326  144 000620A0 GetOldestEventLogRecord
       1327  145 00050BF0 GetOverlappedAccessResults
       1328  146 0003B3D0 GetPrivateObjectSecurity
       1329  147 0000C738 GetSecurityDescriptorControl
       1330  148 0001B5D0 GetSecurityDescriptorDacl
       1331  149 0000C790 GetSecurityDescriptorGroup
       1332  14A 0000C724 GetSecurityDescriptorLength
       1333  14B 0000C74C GetSecurityDescriptorOwner
       1334  14C 0003B3C4 GetSecurityDescriptorRMControl
       1335  14D 00011E00 GetSecurityDescriptorSacl
       1336  14E 0000A8E0 GetSecurityInfo
       1337  14F 00064B00 GetSecurityInfoExA
       1338  150 0005D510 GetSecurityInfoExW
       1339  151 0004D950 GetServiceDisplayNameA
       1340  152 00023E40 GetServiceDisplayNameW
       1341  153 0004D9E0 GetServiceKeyNameA
       1342  154 00023F10 GetServiceKeyNameW
       1343  155 0000A6C4 GetSidIdentifierAuthority
       1344  156 0000A8CC GetSidLengthRequired
       1345  157 00011754 GetSidSubAuthority
       1346  158 00011740 GetSidSubAuthorityCount
       1347  159 00040590 GetThreadWaitChain
       1348  15A 0001BD50 GetTokenInformation
       1349  15B          GetTraceEnableFlags (forwarded to ntdll.EtwGetTraceEnableFlags)
       1350  15C          GetTraceEnableLevel (forwarded to ntdll.EtwGetTraceEnableLevel)
       1351  15D          GetTraceLoggerHandle (forwarded to ntdll.EtwGetTraceLoggerHandle)
       1352  15E 00045130 GetTrusteeFormA
       1353  15F 00045130 GetTrusteeFormW
       1354  160 00045170 GetTrusteeNameA
       1355  161 00045170 GetTrusteeNameW
       1356  162 00045150 GetTrusteeTypeA
       1357  163 00045150 GetTrusteeTypeW
       1358  164 0000DC20 GetUserNameA
       1359  165 00011FD0 GetUserNameW
       1360  166 0003B3B8 GetWindowsAccountDomainSid
       1361  167          I_QueryTagInformation (forwarded to api-ms-win-service-winsvc-l1-1-0.I_QueryTagInformation)
       1001  168 00042AB0 I_ScGetCurrentGroupStateW
       1362  169          I_ScIsSecurityProcess (forwarded to api-ms-win-service-winsvc-l1-1-0.I_ScIsSecurityProcess)
       1363  16A          I_ScPnPGetServiceName (forwarded to api-ms-win-service-winsvc-l1-1-0.I_ScPnPGetServiceName)
       1364  16B          I_ScQueryServiceConfig (forwarded to api-ms-win-service-winsvc-l1-1-0.I_ScQueryServiceConfig)
       1365  16C          I_ScSendPnPMessage (forwarded to api-ms-win-service-winsvc-l1-1-0.I_ScSendPnPMessage)
       1366  16D          I_ScSendTSMessage (forwarded to api-ms-win-service-winsvc-l1-1-0.I_ScSendTSMessage)
       1367  16E 00049220 I_ScSetServiceBitsA
       1368  16F 00006850 I_ScSetServiceBitsW
       1369  170          I_ScValidatePnPService (forwarded to api-ms-win-service-winsvc-l1-1-0.I_ScValidatePnPService)
       1370  171 0001E470 IdentifyCodeAuthzLevelW
       1371  172 0003B3AC ImpersonateAnonymousToken
       1372  173 0000BBCC ImpersonateLoggedOnUser
       1373  174 0003B3A0 ImpersonateNamedPipeClient
       1374  175 0000C180 ImpersonateSelf
       1375  176 0001B4E4 InitializeAcl
       1376  177 0001B504 InitializeSecurityDescriptor
       1377  178 0000A8B0 InitializeSid
       1378  179 00068390 InitiateShutdownA
       1379  17A 00062E80 InitiateShutdownW
       1380  17B 000685F0 InitiateSystemShutdownA
       1381  17C 000684F0 InitiateSystemShutdownExA
       1382  17D 00062FF0 InitiateSystemShutdownExW
       1383  17E 00063110 InitiateSystemShutdownW
       1384  17F 000754F0 InstallApplication
       1385  180 00020720 IsTextUnicode
       1386  181 0000D2E8 IsTokenRestricted
       1387  182 00046350 IsTokenUntrusted
       1388  183 0000C7A4 IsValidAcl
       1389  184          IsValidRelativeSecurityDescriptor (forwarded to KERNELBASE.IsValidRelativeSecurityDescriptor)
       1390  185 0000C710 IsValidSecurityDescriptor
       1391  186 00011730 IsValidSid
       1392  187 0000D7A4 IsWellKnownSid
       1393  188 0004D8D0 LockServiceDatabase
       1394  189 0006FBB0 LogonUserA
       1395  18A 0006FB40 LogonUserExA
       1396  18B 0000BABC LogonUserExExW
       1397  18C 0006FAD0 LogonUserExW
       1398  18D 0000B560 LogonUserW
       1399  18E 0003F2CC LookupAccountNameA
       1400  18F 0000DED4 LookupAccountNameW
       1401  190 0003F044 LookupAccountSidA
       1402  191 0001B898 LookupAccountSidW
       1403  192 00066B20 LookupPrivilegeDisplayNameA
       1404  193 000669A0 LookupPrivilegeDisplayNameW
       1405  194 00066E50 LookupPrivilegeNameA
       1406  195 00066CF0 LookupPrivilegeNameW
       1407  196 00001A00 LookupPrivilegeValueA
       1408  197 0001B9E0 LookupPrivilegeValueW
       1409  198 0005E1E0 LookupSecurityDescriptorPartsA
       1410  199 00050F00 LookupSecurityDescriptorPartsW
       1411  19A 00049060 LsaAddAccountRights
       1412  19B 000480A0 LsaAddPrivilegesToAccount
       1413  19C 000488D0 LsaClearAuditLog
       1414  19D 00022040 LsaClose
       1415  19E 0006A050 LsaCreateAccount
       1416  19F 00069DE0 LsaCreateSecret
       1417  1A0 00069F80 LsaCreateTrustedDomain
       1418  1A1 00065DB0 LsaCreateTrustedDomainEx
       1419  1A2 00052E30 LsaDelete
       1420  1A3 00048DF0 LsaDeleteTrustedDomain
       1421  1A4 000490D0 LsaEnumerateAccountRights
       1422  1A5 00048340 LsaEnumerateAccounts
       1423  1A6 00049180 LsaEnumerateAccountsWithUserRight
       1424  1A7 00048160 LsaEnumeratePrivileges
       1425  1A8 00048100 LsaEnumeratePrivilegesOfAccount
       1426  1A9 00048200 LsaEnumerateTrustedDomains
       1427  1AA 00048C80 LsaEnumerateTrustedDomainsEx
       1428  1AB 0000E390 LsaFreeMemory
       1429  1AC 00047FE0 LsaGetQuotasForAccount
       1430  1AD 0005FC80 LsaGetRemoteUserName
       1431  1AE 00047F20 LsaGetSystemAccessAccount
       1432  1AF 0000B9E0 LsaGetUserName
       1433  1B0 00026060 LsaICLookupNames
       1434  1B1 0000A500 LsaICLookupNamesWithCreds
       1435  1B2 0000ACD0 LsaICLookupSids
       1436  1B3 00003700 LsaICLookupSidsWithCreds
       1437  1B4 0005FE50 LsaLookupNames
       1438  1B5 00025FF0 LsaLookupNames2
       1439  1B6 00048580 LsaLookupPrivilegeDisplayName
       1440  1B7 00048830 LsaLookupPrivilegeName
       1441  1B8 0001BAB0 LsaLookupPrivilegeValue
       1442  1B9 0000AB60 LsaLookupSids
       1443  1BA 00052FD0 LsaManageSidNameMapping
       1444  1BB 00047E40 LsaNtStatusToWinError
       1445  1BC 00069D10 LsaOpenAccount
       1446  1BD 00020B40 LsaOpenPolicy
       1447  1BE 00065C20 LsaOpenPolicySce
       1448  1BF 00069C40 LsaOpenSecret
       1449  1C0 00069EB0 LsaOpenTrustedDomain
       1450  1C1 00065CF0 LsaOpenTrustedDomainByName
       1451  1C2 00048C10 LsaQueryDomainInformationPolicy
       1452  1C3 00048B40 LsaQueryForestTrustInformation
       1453  1C4 000482A0 LsaQueryInfoTrustedDomain
       1454  1C5 000220B0 LsaQueryInformationPolicy
       1455  1C6 00069BA0 LsaQuerySecret
       1456  1C7 000484F0 LsaQuerySecurityObject
       1457  1C8 00048F30 LsaQueryTrustedDomainInfo
       1458  1C9 00048D80 LsaQueryTrustedDomainInfoByName
       1459  1CA 00048FF0 LsaRemoveAccountRights
       1460  1CB 00048040 LsaRemovePrivilegesFromAccount
       1461  1CC 00004450 LsaRetrievePrivateData
       1462  1CD 00048BA0 LsaSetDomainInformationPolicy
       1463  1CE 00048AD0 LsaSetForestTrustInformation
       1464  1CF 00052EC0 LsaSetInformationPolicy
       1465  1D0 00065A20 LsaSetInformationTrustedDomain
       1466  1D1 00047F80 LsaSetQuotasForAccount
       1467  1D2 000659B0 LsaSetSecret
       1468  1D3 000483E0 LsaSetSecurityObject
       1469  1D4 00047EC0 LsaSetSystemAccessAccount
       1470  1D5 00065E90 LsaSetTrustedDomainInfoByName
       1471  1D6 00048E50 LsaSetTrustedDomainInformation
       1472  1D7 000660A0 LsaStorePrivateData
       1473  1D8          MD4Final (forwarded to NTDLL.MD4Final)
       1474  1D9          MD4Init (forwarded to NTDLL.MD4Init)
       1475  1DA          MD4Update (forwarded to NTDLL.MD4Update)
       1476  1DB          MD5Final (forwarded to NTDLL.MD5Final)
       1477  1DC          MD5Init (forwarded to NTDLL.MD5Init)
       1478  1DD          MD5Update (forwarded to NTDLL.MD5Update)
       1479  1DE 00066540 MSChapSrvChangePassword
       1480  1DF 00053BB0 MSChapSrvChangePassword2
       1481  1E0 0000AEE8 MakeAbsoluteSD
       1482  1E1 0003B390 MakeAbsoluteSD2
       1483  1E2 0000A9A8 MakeSelfRelativeSD
       1484  1E3 0000819C MapGenericMask
       1485  1E4 00003B90 NotifyBootConfigStatus
       1486  1E5 00062100 NotifyChangeEventLog
       1487  1E6 00008A88 NotifyServiceStatusChange
       1488  1E7 00026CA0 NotifyServiceStatusChangeA
       1489  1E8 00008A80 NotifyServiceStatusChangeW
       1490  1E9 000543F0 ObjectCloseAuditAlarmA
       1491  1EA 0003B380 ObjectCloseAuditAlarmW
       1492  1EB 00054370 ObjectDeleteAuditAlarmA
       1493  1EC 0003B374 ObjectDeleteAuditAlarmW
       1494  1ED 00054510 ObjectOpenAuditAlarmA
       1495  1EE 0003B300 ObjectOpenAuditAlarmW
       1496  1EF 00054470 ObjectPrivilegeAuditAlarmA
       1497  1F0 0003B2D8 ObjectPrivilegeAuditAlarmW
       1498  1F1 00067500 OpenBackupEventLogA
       1499  1F2 00061BF0 OpenBackupEventLogW
       1500  1F3 00061320 OpenEncryptedFileRawA
       1501  1F4 000612C0 OpenEncryptedFileRawW
       1502  1F5 00061B00 OpenEventLogA
       1503  1F6 00006A90 OpenEventLogW
       1504  1F7 0001BD70 OpenProcessToken
       1505  1F8 00017B90 OpenSCManagerA
       1506  1F9 0000C2A8 OpenSCManagerW
       1507  1FA 00017B7C OpenServiceA
       1508  1FB 0000C2C0 OpenServiceW
       1509  1FC 0001BD84 OpenThreadToken
       1510  1FD 0003ED98 OpenThreadWaitChainSession
       1511  1FE 00068770 OpenTraceA
       1512  1FF 0000F350 OpenTraceW
       1513  200 00071990 PerfAddCounters
       1514  201 00062C80 PerfCloseQueryHandle
       1515  202          PerfCreateInstance (forwarded to pcwum.PerfCreateInstance)
       1516  203          PerfDecrementULongCounterValue (forwarded to pcwum.PerfDecrementULongCounterValue)
       1517  204          PerfDecrementULongLongCounterValue (forwarded to pcwum.PerfDecrementULongLongCounterValue)
       1518  205 00071980 PerfDeleteCounters
       1519  206          PerfDeleteInstance (forwarded to pcwum.PerfDeleteInstance)
       1520  207 00038AA0 PerfEnumerateCounterSet
       1521  208 0006E7C0 PerfEnumerateCounterSetInstances
       1522  209          PerfIncrementULongCounterValue (forwarded to pcwum.PerfIncrementULongCounterValue)
       1523  20A          PerfIncrementULongLongCounterValue (forwarded to pcwum.PerfIncrementULongLongCounterValue)
       1524  20B 00062D30 PerfOpenQueryHandle
       1525  20C 000719A0 PerfQueryCounterData
       1526  20D 0006E6B0 PerfQueryCounterInfo
       1527  20E 000395E0 PerfQueryCounterSetRegistrationInfo
       1528  20F          PerfQueryInstance (forwarded to pcwum.PerfQueryInstance)
       1529  210          PerfSetCounterRefValue (forwarded to pcwum.PerfSetCounterRefValue)
       1530  211          PerfSetCounterSetInfo (forwarded to pcwum.PerfSetCounterSetInfo)
       1531  212          PerfSetULongCounterValue (forwarded to pcwum.PerfSetULongCounterValue)
       1532  213          PerfSetULongLongCounterValue (forwarded to pcwum.PerfSetULongLongCounterValue)
       1533  214          PerfStartProvider (forwarded to pcwum.PerfStartProvider)
       1534  215          PerfStartProviderEx (forwarded to pcwum.PerfStartProviderEx)
       1535  216          PerfStopProvider (forwarded to pcwum.PerfStopProvider)
       1536  217 0000BD14 PrivilegeCheck
       1537  218 000542A0 PrivilegedServiceAuditAlarmA
       1538  219 0003B2BC PrivilegedServiceAuditAlarmW
       1539  21A 000497D0 ProcessIdleTasks
       1540  21B 00053970 ProcessIdleTasksW
       1541  21C 00010B30 ProcessTrace
       1542  21D 0006BC50 QueryAllTracesA
       1543  21E 00003BF0 QueryAllTracesW
       1544  21F 000611E0 QueryRecoveryAgentsOnEncryptedFile
       1545  220 0003B2B0 QuerySecurityAccessMask
       1546  221 0003B290 QueryServiceConfig2A
       1547  222 0003B270 QueryServiceConfig2W
       1548  223 0003B25C QueryServiceConfigA
       1549  224 0000C6FC QueryServiceConfigW
       1550  225 0004D7C0 QueryServiceLockStatusA
       1551  226 0004D6B0 QueryServiceLockStatusW
       1552  227 0003B23C QueryServiceObjectSecurity
       1553  228 0001382C QueryServiceStatus
       1554  229 00007004 QueryServiceStatusEx
       1555  22A 00068760 QueryTraceA
       1556  22B 00009B50 QueryTraceW
       1557  22C 00061250 QueryUsersOnEncryptedFile
       1558  22D 0004A180 ReadEncryptedFileRaw
       1559  22E 00061A70 ReadEventLogA
       1560  22F 00061B70 ReadEventLogW
       1561  230 00020710 RegCloseKey
       1562  231 0006BC30 RegConnectRegistryA
       1563  232 0006BBA0 RegConnectRegistryExA
       1564  233 00068290 RegConnectRegistryExW
       1565  234 00023CB0 RegConnectRegistryW
       1566  235 00062C00 RegCopyTreeA
       1567  236 00057DE0 RegCopyTreeW
       1568  237 00007C50 RegCreateKeyA
       1569  238 00011D10 RegCreateKeyExA
       1570  239 0001B520 RegCreateKeyExW
       1571  23A 0004DDD0 RegCreateKeyTransactedA
       1572  23B 0000A2F0 RegCreateKeyTransactedW
       1573  23C 00011F00 RegCreateKeyW
       1574  23D 000264A0 RegDeleteKeyA
       1575  23E 0004A040 RegDeleteKeyExA
       1576  23F 0000A740 RegDeleteKeyExW
       1577  240 0004DCB0 RegDeleteKeyTransactedA
       1578  241 0000A1C0 RegDeleteKeyTransactedW
       1579  242 00043CB0 RegDeleteKeyValueA
       1580  243 00043C50 RegDeleteKeyValueW
       1581  244 00011B00 RegDeleteKeyW
       1582  245 00049F70 RegDeleteTreeA
       1583  246 00049F80 RegDeleteTreeW
       1584  247 00011850 RegDeleteValueA
       1585  248 0000BBB0 RegDeleteValueW
       1586  249 0000B070 RegDisablePredefinedCache
       1587  24A 0004A030 RegDisablePredefinedCacheEx
       1588  24B 00013CB0 RegDisableReflectionKey
       1589  24C 00013CB0 RegEnableReflectionKey
       1590  24D 00006FA0 RegEnumKeyA
       1591  24E 00011D70 RegEnumKeyExA
       1592  24F 0001C310 RegEnumKeyExW
       1593  250 0001BF20 RegEnumKeyW
       1594  251 0000D680 RegEnumValueA
       1595  252 0001C420 RegEnumValueW
       1596  253 000046E0 RegFlushKey
       1597  254 00004140 RegGetKeySecurity
       1598  255 0000A6F0 RegGetValueA
       1599  256 00011770 RegGetValueW
       1600  257 00062B60 RegLoadAppKeyA
       1601  258 00057B50 RegLoadAppKeyW
       1602  259 00049FC0 RegLoadKeyA
       1603  25A 00049FB0 RegLoadKeyW
       1604  25B 00049FF0 RegLoadMUIStringA
       1605  25C 000117D0 RegLoadMUIStringW
       1606  25D 00011820 RegNotifyChangeKeyValue
       1607  25E 00012010 RegOpenCurrentUser
       1608  25F 0000D6D0 RegOpenKeyA
       1609  260 0001B5F0 RegOpenKeyExA
       1610  261 000206F0 RegOpenKeyExW
       1611  262 0004DD30 RegOpenKeyTransactedA
       1612  263 0000A250 RegOpenKeyTransactedW
       1613  264 00013280 RegOpenKeyW
       1614  265 00024870 RegOpenUserClassesRoot
       1615  266 0004DEA0 RegOverridePredefKey
       1616  267 000263B0 RegQueryInfoKeyA
       1617  268 0001C360 RegQueryInfoKeyW
       1618  269 0006B400 RegQueryMultipleValuesA
       1619  26A 0006AEC0 RegQueryMultipleValuesW
       1620  26B 00049C50 RegQueryReflectionKey
       1621  26C 00003F40 RegQueryValueA
       1622  26D 0001C480 RegQueryValueExA
       1623  26E 0001C2D0 RegQueryValueExW
       1624  26F 0001BDC0 RegQueryValueW
       1625  270 00043D10 RegRenameKey
       1626  271 00057920 RegReplaceKeyA
       1627  272 00057790 RegReplaceKeyW
       1628  273 00049FD0 RegRestoreKeyA
       1629  274 000242E0 RegRestoreKeyW
       1630  275 000680C0 RegSaveKeyA
       1631  276 00049FE0 RegSaveKeyExA
       1632  277 00023FF0 RegSaveKeyExW
       1633  278 00024010 RegSaveKeyW
       1634  279 0000BD00 RegSetKeySecurity
       1635  27A 00043B90 RegSetKeyValueA
       1636  27B 00023A60 RegSetKeyValueW
       1637  27C 0004DA60 RegSetValueA
       1638  27D 00011DC0 RegSetValueExA
       1639  27E 00011ED0 RegSetValueExW
       1640  27F 000258B0 RegSetValueW
       1641  280 00049FA0 RegUnLoadKeyA
       1642  281 00049F90 RegUnLoadKeyW
       1643  282 00026CC0 RegisterEventSourceA
       1644  283 000136B0 RegisterEventSourceW
       1645  284 00004990 RegisterIdleTask
       1646  285 0003B230 RegisterServiceCtrlHandlerA
       1647  286 0003B224 RegisterServiceCtrlHandlerExA
       1648  287 0000A3EC RegisterServiceCtrlHandlerExW
       1649  288 000036C0 RegisterServiceCtrlHandlerW
       1650  289          RegisterTraceGuidsA (forwarded to ntdll.EtwRegisterTraceGuidsA)
       1651  28A          RegisterTraceGuidsW (forwarded to ntdll.EtwRegisterTraceGuidsW)
       1652  28B 0003A868 RegisterWaitChainCOMCallback
       1653  28C 0004FD70 RemoveTraceCallback
       1654  28D 00061170 RemoveUsersFromEncryptedFile
       1655  28E 00061880 ReportEventA
       1656  28F 0000E000 ReportEventW
       1657  290 0000DD00 RevertToSelf
       1658  291 0001F660 SaferCloseLevel
       1659  292 0001F9B0 SaferComputeTokenFromLevel
       1660  293 00069900 SaferCreateLevel
       1661  294 00007EA0 SaferGetLevelInformation
       1662  295 000086C0 SaferGetPolicyInformation
       1663  296 0001E470 SaferIdentifyLevel
       1664  297 0006C440 SaferRecordEventLogEntry
       1665  298 000697E0 SaferSetLevelInformation
       1666  299 0006C650 SaferSetPolicyInformation
       1667  29A 000652D0 SaferiChangeRegistryScope
       1668  29B 0000B410 SaferiCompareTokenLevels
       1669  29C 0003F4DC SaferiIsDllAllowed
       1670  29D 000084F0 SaferiIsExecutableFileType
       1671  29E 0005E8D0 SaferiPopulateDefaultsInRegistry
       1672  29F 0006C440 SaferiRecordEventLogEntry
       1673  2A0 00007B90 SaferiSearchMatchingHashRules
       1674  2A1 0003B218 SetAclInformation
       1675  2A2 0004A080 SetEncryptedFileMetadata
       1676  2A3 00064A70 SetEntriesInAccessListA
       1677  2A4 0005C840 SetEntriesInAccessListW
       1678  2A5 00051160 SetEntriesInAclA
       1679  2A6 00013540 SetEntriesInAclW
       1680  2A7 00064A30 SetEntriesInAuditListA
       1681  2A8 0005C800 SetEntriesInAuditListW
       1682  2A9 00054210 SetFileSecurityA
       1683  2AA 00007D2C SetFileSecurityW
       1684  2AB 000697E0 SetInformationCodeAuthzLevelW
       1685  2AC 0006C650 SetInformationCodeAuthzPolicyW
       1686  2AD 00011E2C SetKernelObjectSecurity
       1687  2AE 0005E570 SetNamedSecurityInfoA
       1688  2AF 0005D800 SetNamedSecurityInfoExA
       1689  2B0 0005DC00 SetNamedSecurityInfoExW
       1690  2B1 000089A0 SetNamedSecurityInfoW
       1691  2B2 0003B1F8 SetPrivateObjectSecurity
       1692  2B3 0003B1D0 SetPrivateObjectSecurityEx
       1693  2B4 0003B1C4 SetSecurityAccessMask
       1694  2B5 00023FE4 SetSecurityDescriptorControl
       1695  2B6 0001B5A0 SetSecurityDescriptorDacl
       1696  2B7 0000F8AC SetSecurityDescriptorGroup
       1697  2B8 0000F898 SetSecurityDescriptorOwner
       1698  2B9 0003B1B8 SetSecurityDescriptorRMControl
       1699  2BA 00011EB0 SetSecurityDescriptorSacl
       1700  2BB 00008420 SetSecurityInfo
       1701  2BC 0005CE50 SetSecurityInfoExA
       1702  2BD 0005D210 SetSecurityInfoExW
       1703  2BE 000574E0 SetServiceBits
       1704  2BF 0003B1AC SetServiceObjectSecurity
       1705  2C0 0000A6D8 SetServiceStatus
       1706  2C1 0000D344 SetThreadToken
       1707  2C2 00006F80 SetTokenInformation
       1708  2C3 0004FE70 SetTraceCallback
       1709  2C4 00061060 SetUserFileEncryptionKey
       1710  2C5 00060FF0 SetUserFileEncryptionKeyEx
       1711  2C6 0003B1A0 StartServiceA
       1712  2C7 0003B194 StartServiceCtrlDispatcherA
       1713  2C8 00005E58 StartServiceCtrlDispatcherW
       1714  2C9 00006FF0 StartServiceW
       1715  2CA 00063D90 StartTraceA
       1716  2CB 0000E5A0 StartTraceW
       1717  2CC 00068740 StopTraceA
       1718  2CD 00011700 StopTraceW
       1719  2CE 0003DA0C SystemFunction001
       1720  2CF 00022BF4 SystemFunction002
       1721  2D0 000069CC SystemFunction003
       1722  2D1 0003D9A0 SystemFunction004
       1723  2D2 0003D934 SystemFunction005
       1724  2D3 000068E0 SystemFunction006
       1725  2D4 0000C800 SystemFunction007
       1726  2D5 00060CD0 SystemFunction008
       1727  2D6 00066530 SystemFunction009
       1728  2D7 000664D0 SystemFunction010
       1729  2D8 0006A800 SystemFunction011
       1730  2D9 00060C80 SystemFunction012
       1731  2DA 00060C30 SystemFunction013
       1732  2DB 00066480 SystemFunction014
       1733  2DC 000664C0 SystemFunction015
       1734  2DD 00060BE0 SystemFunction016
       1735  2DE 00060B90 SystemFunction017
       1736  2DF 000664B0 SystemFunction018
       1737  2E0 000664A0 SystemFunction019
       1738  2E1 00066480 SystemFunction020
       1739  2E2 000664C0 SystemFunction021
       1740  2E3 00066480 SystemFunction022
       1741  2E4 000664C0 SystemFunction023
       1742  2E5 00060B10 SystemFunction024
       1743  2E6 00022B80 SystemFunction025
       1744  2E7 00066490 SystemFunction026
       1745  2E8 00022B70 SystemFunction027
       1746  2E9 0003D8D8 SystemFunction028
       1747  2EA 0003D87C SystemFunction029
       1748  2EB 00022B10 SystemFunction030
       1749  2EC 00022B10 SystemFunction031
       1750  2ED 000538F0 SystemFunction032
       1751  2EE 000538F0 SystemFunction033
       1752  2EF 0003D810 SystemFunction034
       1753  2F0          SystemFunction035 (forwarded to CRYPTSP.CheckSignatureInFile)
       1754  2F1 00001044 SystemFunction036
       1755  2F2 00007DE0 SystemFunction040
       1756  2F3 00007D70 SystemFunction041
       1757  2F4          TraceEvent (forwarded to ntdll.EtwLogTraceEvent)
       1758  2F5          TraceEventInstance (forwarded to ntdll.EtwTraceEventInstance)
       1759  2F6          TraceMessage (forwarded to ntdll.EtwTraceMessage)
       1760  2F7          TraceMessageVa (forwarded to ntdll.EtwTraceMessageVa)
       1761  2F8 0003D390 TraceSetInformation
       1762  2F9 00045300 TreeResetNamedSecurityInfoA
       1763  2FA 000454C0 TreeResetNamedSecurityInfoW
       1764  2FB 00045300 TreeSetNamedSecurityInfoA
       1765  2FC 000453D0 TreeSetNamedSecurityInfoW
       1766  2FD 0005C4A0 TrusteeAccessToObjectA
       1767  2FE 0005C6F0 TrusteeAccessToObjectW
       1768  2FF 00052CA0 UninstallApplication
       1769  300 0004D640 UnlockServiceDatabase
       1770  301 00049910 UnregisterIdleTask
       1771  302          UnregisterTraceGuids (forwarded to ntdll.EtwUnregisterTraceGuids)
       1772  303 00068720 UpdateTraceA
       1773  304 00068700 UpdateTraceW
       1774  305 00060E10 UsePinForEncryptedFilesA
       1775  306 00066800 UsePinForEncryptedFilesW
       1776  307 00018650 WmiCloseBlock
       1777  308 0005A4B0 WmiDevInstToInstanceNameA
       1778  309 000257E0 WmiDevInstToInstanceNameW
       1779  30A 0005A580 WmiEnumerateGuids
       1780  30B 0005AF90 WmiExecuteMethodA
       1781  30C 0005ABD0 WmiExecuteMethodW
       1782  30D 0005A990 WmiFileHandleToInstanceNameA
       1783  30E 0005A760 WmiFileHandleToInstanceNameW
       1784  30F 00009B10 WmiFreeBuffer
       1785  310 00068ED0 WmiMofEnumerateResourcesA
       1786  311 00009660 WmiMofEnumerateResourcesW
       1787  312 00074990 WmiNotificationRegistrationA
       1788  313 0000A760 WmiNotificationRegistrationW
       1789  314 00018380 WmiOpenBlock
       1790  315 00074CA0 WmiQueryAllDataA
       1791  316 0005BA90 WmiQueryAllDataMultipleA
       1792  317 0005B870 WmiQueryAllDataMultipleW
       1793  318 00018440 WmiQueryAllDataW
       1794  319 00009A70 WmiQueryGuidInformation
       1795  31A 0006E9B0 WmiQuerySingleInstanceA
       1796  31B 00064590 WmiQuerySingleInstanceMultipleA
       1797  31C 0005B610 WmiQuerySingleInstanceMultipleW
       1798  31D 00025600 WmiQuerySingleInstanceW
       1799  31E 0006EA90 WmiReceiveNotificationsA
       1800  31F 00023140 WmiReceiveNotificationsW
       1801  320 0005B540 WmiSetSingleInstanceA
       1802  321 0005B350 WmiSetSingleInstanceW
       1803  322 0005B280 WmiSetSingleItemA
       1804  323 0005B080 WmiSetSingleItemW
       1805  324 0004A160 WriteEncryptedFileRaw
       1000      00045CE0 [NONAME]

  Summary

        5000 .data
        8000 .pdata
       32000 .rdata
        2000 .reloc
       24000 .rsrc
       75000 .text
*/